I wrote a post about this a while ago - you essentially need to form the sql statement first by declaring a long varchar and then executing it.

http://www.geakeit.co.uk/2011/02/05/a-table-input-variable-in-a-stored-procedure-and-bypassing-must-declare-the-table-variable-msg-1087/